On the security and degradability of Gaussian channels 
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We consider the notion of canonical attacks, which are the cryptographic analog of the canonical 
forms of a one-mode Gaussian channel. Using this notion, we explore the connections between the 
degradability properties of the channel and its security for quantum key distribution. Finally, we 
also show some relations between canonical attacks and optimal Gaussian doners. 



I. INTRODUCTION 



Today, quantum cryptography is one of the most promising areas in quantum information science. This is partic- 
ularly true in the framework of continuous variable (CV) systems [H, which are quantum systems characterized by 
infinite-dimensional Hilbert spaces. The increasing interest in CV quantum cryptography is mainly due to the prac- 
tical advantages of quantum key distribution (QKD) using Gaussian states 0, U 0, H, [f| . Furthermore, this Gaussian 
QKD has been also extended to multiple quantum communications [3] and the non-trivial possibility of a quantum 
direct communication has been also explored Q. Very recently, a new insight in the theory of quantum channels 
has been provided by the canonical classification of the one-mode Gaussian channels 0] (see also Refs. [T3, [H| an d 
the compact version of this classification in Ref. Q). These channels have been proven to be unitarily equivalent to 
canonical forms of six different classes @, whose degradability properties have been also studied 11 1. Here, we exploit 
these concepts in the scenario of quantum cryptography. In particular, we consider the notion of canonical attacks 
as the cryptographic analog of the canonical forms. By adopting the individual version of these canonical attacks, 
we explore the connections between the degradability properties of the channel and its security for QKD. Then, we 
also show when (and in what sense) these attacks can be considered equivalent to individual attacks using optimal 
Gaussian doners. 



II. QUANTUM COMMUNICATION SCENARIO 



The simplest continuous variable system is a single bosonic mode, i.e., a quantum system described by a pair of 
quadrature operators x T := (q,p) with [q,p] — 2i. In particular, a single-mode bosonic state p with Gaussian statistics 
is called Gaussian state and it is completely characterized by a 2 x 2 covariance matrix V plus a displacement vector 
x e M 2 . Then, a one-mode Gaussian channel is a completely positive trace-preserving (CPT) map £/(T,N,d) 
transforming an input Gaussian state /9 (V ,x ) of a sender (Alice) into an output Gaussian state pb(Vb,^-b) of a 
receiver (Bob) via the relations V& = TV a T T + N and x& = Tx a +d. Here, deR 2 and T, N are 2x2 real matrices, 
with N T = N > and det N > (det T — l) 2 . Up to unitaries on the input and the output, every one- mode Gaussian 
channel is equivalent to a map C, called the canonical form, which is a Gaussian channel with d = and T C ,N C 
diagonal [9(. According to Ref. [5[, the explicit expressions of T c and N c depend on three symplectic invariants of 
the channel: the generalized transmission r := detT (ranging from — oo to +00), the rank r := [rk(T)rk(N)]/2 (with 
possible values r = 0,1,2) and the temperature n (which is a positive number related to detN [5j). These three 
invariants {r, r, n} completely characterize the two matrices T c , N c and, therefore, the corresponding canonical form 
C = C(t, r, n). In particular, the first two invariants {r, r} determine the class of the form [5, 9]. The full classification 
is explicitly shown in the following table 
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In this table, the values of {r, r} in the first two columns specify a particular class Ai, A2, -Bi, B2, C and D [l2j| . Within 
each class, the possible canonical forms are expressed in the third column, where also the third invariant n must be 
considered. The corresponding expressions of T C ,N C are shown in the last two columns, where Z := diag(l,— 1), 
I := diag(l, 1) and is the zero matrix. 

By adopting a Stinespring dilation of the quantum channel, we can describe a canonical form C(r, r, h) via a 
symplectic transformation M ae § mixing the input signal mode {a} with two vacuum environmental modes {e,e} and 
yielding the output modes {&} for Bob and {c, c} for the environment [see Fig. [TJi)]. Such a dilation is known to 
be unique up to partial isometries. For class B2, also known as an additive-noise channel, the Stinespring dilation 
corresponds to an optimal Gaussian doner (OGC) which clones asymmetrically in the clones but symmetrically in 
the quadratures (l3| . Such a machine transforms the input mode {a} and the two vacuum modes {e,e} into a pair 
of clone modes {b, c} and an anticlone mode {c}. In particular the reduced state of the output clone k ~ b, c is given 
by the modulated state 

p k = [ d 2 j G Xfc ( 7 )£)( 7 )p a ^t (7) , Gxfc(7 ) := _^ exp [ _J± ) , (i) 
J i^Xk \ Xk J 

where D(j) is the displacement operator and Xk is the cloning noise variance satisfying XbXc = 1 with xt — n. 
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FIG. 1: Inset (i): Stinespring dilation of a canonical form. It describes a canonical attack by including the optimal coherent 
detection of all the outputs {c, £} collected in all the uses of the channel. Both the dilation and the attack are unique up to 
isometries acting on the environmental modes {c, c}. Inset (ii): Stinespring dilation of a canonical form of every class but B2; 
the form is antidegradable (degradable) if there exists a map A (T>) such that pb = A(p C c) [pc& = T>(pb)]. Inset (iii): Physical 
representation of a canonical form of every class but B2; the form is strongly antidegradable (weakly degradable) if there exists 
a map A s (T> w ) such that p b = A s (p c ) [pc = T> w (p b )]. 

It is important to notice that class B2 is the unique class where the Stinespring dilation cannot be simplified to 
a single-mode description 0. For all the other classes, in fact, we can consider a dilation where the symplectic 
transformation M ae g can be decomposed as M ae Ig, involving the signal mode {a} and only one mode {e} of the 
two-mode environment {e, e} [see Fig. HJii)]. This is possible if the environment is prepared in a two-mode squeezed 
vacuum (TMSV) state \u>) i.e., in a pure Gaussian state with correlation matrix 

V eS (u)=( ^ T ^ TZ ) , w: = 2 ft+l>l. (2) 

Such a dilation {M ae ©Ig, is the purification of a single-mode physical representation [l4| {M ae , /c(n)}, where M ae 
mixes the signal mode {a} with a single environmental mode {e}, prepared in a thermal state p e (n) with h average 
photons [Til ] . This physical representation can also be seen as a quantum broadcast channel where the symplectic 
M oe relates the output quadratures y^ ut = (qb,Pb,<lc,Pc) of two receivers (Bob and Charlie) to the input quadratures 
xf n = (q a ,p a ,q e ,p e ) of a sender (Alice) and a thermal environment [see Fig. QJiii)]. 

An important property of all the canonical forms (except B 2 [HI) is their degradability or antidegradability [Til . 
[l6j . A canonical form is called strongly antidegradable if it has a single-mode physical representation {M ae , p(n)} 
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where Charlie can reconstruct Bob's state pb via some CPT map A 8 , i.e., pb = A s (p c ). Notice that the strong 
antidegradability {a} — ► {c} — * {b} is a sufficient but not necessary condition for the (standard) antidegradability 
{a} — > {c, 2} — > {6}, where Bob's state is reconstructed by considering all the degrees of freedom of the environment 
(Eve). In fact, the form is called antidegradable if there exists a CPT map A such that pb — A{p c z)- In the same 
way, one can consider the weak degradability {a} — > {b} — > {c} which is implied by the (standard) degradability 
{a} — ► {b} — > {c, c}. In fact, degradability corresponds to the existence of a map T> such that p C £ = T>{pb), while 
weak degradability corresponds to the existence of a map T> w such that p c = T> w (pb) for some physical representation. 
Clearly the weak/strong notions coincide with the standard ones when n = 1. 

From the point of view of practical quantum cryptography, classes C and D are the most important ones. These 
classes are full-rank (r = 2) and represent the unique classes where the invariant r can take a continuum of values, 
except for the singular points r = and r = 1. Because of this continuity, we call the canonical forms C(t, 2,n) of 
classes C and D as regular. For these forms, one can consider a single-mode physical representation {M ae , p{n)} with 
symplectic matrix 
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where s(- • • ) is the sign function. Notice that Eq. ([3]) corresponds to a beam splitter for < t < 1 and to an amplifier 
for t > 1. A regular canonical form C(t, 2,n) is strongly antidegradable (weakly degradable) if and only if t < 1/2 
(r> 1/2) M- 



III. QUANTUM CRYPTOGRAPHY SCENARIO 



In the standard scenario of quantum cryptography, the environment is completely under control of a malicious 
eavesdropper (Eve). Here, a one-mode channel can be generally seen as the effect of a collective attack, where Eve 
probes the signals using individual interactions and then performs a coherent detection of all the outputs collected 
in all the uses of the channel. According to Ref. [5(, one can define as a "canonical attack" a collective attack that 
generates a one-mode Gaussian channel in canonical form. This is actually a particular form of the most general 
collective Gaussian attack that is completely characterized in Ref. Up to partial isometries, a canonical attack is 
described by combining the two- mode Stinespring dilation {M ae g, |0)} of the canonical form with the optimal coherent 
detection of all the environmental outputs, which are collected in all the uses of the channel [see Fig. QJi) including 
Eve]. In the special case of the class B2, the corresponding B2 canonical attacks are OGC attacks where both the 
clone and anticlone are used in the final coherent measurement. In all the other cases, the canonical attacks can 
be simplified according to Fig. [TJii) where Eve uses a single-mode symplectic interaction M ae and the TMSV state 
specified by Eq. |2]). In particular, the regular canonical attacks are the ones with M ae (r) given in Eq. ([3J). These 
attacks can be associated to a pair {r, lu} with r ^ 0,1. 

In this paper, we consider the individual version of the regular canonical attacks (denoted by {r, u)}md), where Eve 
is restricted to incoherent detections of her outputs (and no isometry is applied) . By adopting this kind of attack, we 
derive the security thresholds of the coherent state protocol of Ref. [3J . In this protocol, Alice prepares a coherent 
state p a ■— I a) (a\ whose amplitude a is Gaussianly modulated with variance p. Then, Alice sends the state through 
the channel, whose output is homodyned by Bob. In particular, Bob randomly switches between the detection of 
qb and pb, the effective sequence being classically communicated at the end of the protocol (basis revelation). Here, 
the optimal attack {r, uj}i n d is a direct generalization of the delayed-choice entangling doner attack of Ref. 0, E3| 
(retrieved in the particular case < r < 1). This means that Eve stores all her outputs in a quantum memory, awaits 
the basis revelation and, then, performs the correct sequence of q and p detections on her outputs. This is equivalent 
to saying that, for each run of the protocol where Bob chooses the q quadrature, Eve also detects the q quadrature 
on her modes {c, c}. In particular, we can assume as first detection one of <jc, which is equivalent to the remote 
preparation of a g-squeezed state on the input mode {e} with variance {0) = lo~ x [17]. As a consequence, Eve is 
always able to control the input environment {e} in such a way as to enhance her detection of the output mode {c} 
in the same quadrature which is effectively chosen by Bob. 

By adopting this optimal attack, let us explicitly derive the security thresholds of the coherent state protocol in the 
limit of high modulation p — > +00. From Eqs. ^ and ([3]), we derive the following variance and conditional variance 
for Bob's output 



Vb(p) = (q 2 b ) = (Pi) = \r\ (M + 1) + |1 - r| u , V B]A = V B (p = 0) 
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Then, we have the following signal-to-noise formula for the classical mutual information 
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where the total noise r](u>, r) := A + x(w, T ) IS given by the sum of the quantum shot-noise A = 1 and the equivalent 
noise of the channel 



1 -r 



(6) 



From the point of view of the classical mutual information of Eq. |5]) . the regular canonical form C(r, 2, n) is equivalent 
to a form C(l, 2, n) of the class i?2 (additive-noise channel), where the input classical signal a with Gaussian modulation 
(i is subject to the additive Gaussian noises x an d A (coming from the channel and the measurement, respectively). 
In fact, in such a case, we would have 



V B = /i + A + x , V b \a = A + x , 



(7) 



which leads exactly to Eq. (j^J for fi — > +oo. In order to analyze the security thresholds, it is useful to introduce the 
so-called excess noise 
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i.e., the equivalent noise can be decomposed in pure-r noise and excess noise e > 0. Roughly speaking, e quantifies the 
effect of the input thermal noise (to) in the equivalent additive description of the quantum channel, which is specified 
by Eq. ©. 




FIG. 2: Security thresholds in DR (thin curve) and RR (thick curve) in the presence of an individual and regular canonical 
attack {t, ui}i„d (where 1). Such thresholds are expressed in terms of maximum-tolerable excess noise e versus r. For a 

given r, only the positive e's below the curves are secure. 



In order to derive the security thresholds, let us compute the mutual information Iae (between Alice and Eve) and 
I be (between Bob and Eve). It is easy to check that 

Vb(ji) = (€) = (fc) = |1 - r| (m + 1) + M u;- 1 , (10) 

V e \a = \1-t\ + \t\u- 1 , V b \ e =[\t\{h+1)- 1 + \1-t\u\~ 1 , (11) 

and, therefore, 

Iae ■= 7; lo g tt > ^ log i _l -i ' Ibe := o log t7 * o logT x/i ■ ( 12 

2 VbL4 2 1 + X 1 2 VgiE 2 
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Then, we can compute the secret-key rates in direct reconciliation (DR, ►) and reverse reconciliation (RR, i.e., 

1 1 + x 1 1 1 

R ■= Iab - Iae^ - log — — , R* := Iab - Ibe -> r log 2 ■ — r ■ (13) 



From i?^ = we derive the security threshold x( £ i T ) = 1 or ? equivalently, the curve e*' = £*(t) shown in Fig. [5] 
From such a figure we clearly see how strong antidegradability (holding for r < 1/2) is a sufficient condition for the 
insecurity of the channel in DR (since = for every r < 1/2). However, it is not a necessary condition as shown by 
the existence of the insecure regions for r > 1/2 and e > b > {t) (where the channel is insecure but weakly degradable). 
This is a consequence of the fact that Eve is much more powerful than Charlie, thanks to her active control of the 
input environment. In fact, even if no strong antidegradability can be found in the range r > 1/2, the channel can be 
still antidegradable, e.g., within the insecure regions for r > 1/2 and e > e^(r). We recover a full equivalence between 
strong antidegradability and insecurity only in the case e = 0, where the channel does not introduce thermal noise. 
In such a case, in fact, the strong antidegradability coincides with the standard antidegradability and the security 
threshold (r = 1/2) corresponds exactly to the threshold between antidegradability and degradability. 

The fact that the strong antidegradability is a sufficient condition for the insecurity in DR is quite obvious. In 
fact, it implies the antidegradability, where Eve can reconstruct Bob's state and, therefore, retrieve at least the same 
information of Bob in decoding Alice's signals (i.e., 3A S =>■ 3A =>• Iae > Iab)- However, the situation is completely 
different in RR, where Alice and Eve try to guess Bob's outcomes. In such a case, even if the channel is strongly 
antidegradable, Bob's outcomes can be much more correlated to Alice's variables than Eve's ones. In general, the 
only way for Eve to beat Alice in RR consists in introducing an environment which is squeezed enough to make her 
correlations prevail. From R* = we derive the discontinuous [1 81 ] security threshold 



e<=e<(r);= ^-M-»|l-r| t (14) 

shown in Fig. O From Fig. [5] it is clear that, even if the channel is strongly antidegradable, QKD can be secure. 
This is due to the existence of the secure region for < t < 1/2 and e < s"*(t). Notice that for r > 1, i.e., for 
an amplifying channel, reverse reconcilation is outperfomed by direct reconciliation. This is in accordance with the 
previous results of Ref . [l9| . 

According to the expression of Iae in Eq. (fT2"|). the Alice- Eve channel can also be described by an additive- noise 
channel where the input classical signal a (with variance n) is modulated by an equivalent channel's noise x _1 and a 
homodyne detection noise A = 1. In fact, we retrieve the same mutual information Iae of Eq. (|12[) by considering 

Ve^h + A + x- 1 , V EI a = A + x~ 1 , (15) 

and taking the asymptotic limit for fi — > +oo. By considering both the Alice-Bob and Alice-Eve channels, one easily 
checks that the optimal {t, Lu}i„d has therefore an equivalent additive description when direct reconciliation and high 
modulation are considered. Such an additive description corresponds to an individual OGC attack where Eve clones 
the input signals with cloning variances Xb — X an d Xc = X~ > stores her clones in a quantum memory and, then, 
makes the correct homodyne detections after the basis revelation 20]. Such an individual attack is optimal since 
the saturation of the uncertainty principle XbXc = 1 minimizes the information-disturbance trade-off, which can be 
expressed by the product of the output conditional variances 

V bia V EI a = (A + x)(A + x - 1 ) ■ (16) 

In direct reconciliation and high modulation, an individual OGC attack with noise x represents therefore an equivalent 
additive description of the optimal attack {r, Lo} in d via Eq. ©. To be precise, there is a whole class of optimal attacks 
{t, uj}i n d, with different r and to but the same x — x( w ! T )i which are equivalent to an individual OGC attack. Notice 
that this equivalence is true for the "switching" protocol of Ref. [3J], but not for the "non-switching" protocol of 
Ref. H. 



IV. CONCLUSION 



In this paper, we have investigated recent notions and properties of the one-mode Gaussian channels in the scenario 
of quantum cryptography. In particular, we have considered the canonical attacks, which are the cryptographic analog 
of the canonical forms. We have adopted the individual version of these attacks in order to study the connections 
between the degradability properties of a Gaussian channel and its security for QKD. We have also explicitly clarified 
the connections between the various notions of degradability and antidegradability. Finally, we have shown some 
connections between individual canonical attacks and optimal Gaussian doners. 
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